https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108357#M28204 <P>hi ,<BR /> Please tell me how to extract 997 from the below statement</P> <P>2013-01-30 19:53:39,995 com.cisco.cts.som.svosubmit.service.entitlement.dao.CCOEntitlementCache - End of the method getCCOEntitlement in com.cisco.cts.som.</P> Sat, 02 Feb 2013 18:34:05 GMT kumar518g 2013-02-02T18:34:05Z https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108357#M28204 <P>hi ,<BR /> Please tell me how to extract 997 from the below statement</P> <P>2013-01-30 19:53:39,995 com.cisco.cts.som.svosubmit.service.entitlement.dao.CCOEntitlementCache - End of the method getCCOEntitlement in com.cisco.cts.som.</P> Sat, 02 Feb 2013 18:34:05 GMT https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108357#M28204 kumar518g 2013-02-02T18:34:05Z https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108358#M28205 <P>Do you mean how do you capture the 995 to a separate field? Use the Interactive Field Extractor (IFX):<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> <P>You might also find it very beneficial to walk through the full tutorial:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Tutorial/WelcometotheSplunkTutorial">http://docs.splunk.com/Documentation/Splunk/5.0.1/Tutorial/WelcometotheSplunkTutorial</A></P> Sat, 02 Feb 2013 19:09:00 GMT https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108358#M28205 Ron_Naken 2013-02-02T19:09:00Z https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108359#M28206 <P>yes exactly,am very new to SPLUNK thx for your quick response now i got it how to extract fields </P> <P>thx</P> Sat, 02 Feb 2013 19:45:40 GMT https://community.splunk.com/t5/Splunk-Search/extacting-time/m-p/108359#M28206 kumar518g 2013-02-02T19:45:40Z